Step-by-Step Palo Alto Windows User-ID Agent Setup Guide [2024]

[@netsums]

FREE Palo Alto Cheat Sheet in different formats and further FREE resources: netsums.com/resources

[@maozkaufmann5255]

You are amazing. Funny to think nobody in this world has provided updated videos on how to do things with Palo Alto.

[@netsums]

Thank you for the comment, I'm glad you like the videos!

[@jmanc2179]

Thank you great content! If you use the default management interface for communications then no need for rules to allow communications between windows user ID agent server and Palo firewall right?

[@RishiRap]

As usual, Great content! Always looking forward to your new meaningful and informational videos.

[@netsums]

Thank you for the comment, I'm glad you liked the video!

[@TariqASheikh]

Would be useful to have link for all pre-requisites etc.

[@netsums]

You're right. I'll take a look at it soon. Thank you!

[@diwakarkumar3216]

Love from India. ❤ Your are doing great contribution for upcoming generation. Please make full course video. It will be helpful if you help me in enabling Google authenticator in GP-VPN❤❤❤

[@netsums]

Thank you for the lovely comnent, I will try!

[@smakersify]

Excellent buddy, subbed

[@netsums]

Thank you! I'm glad you liked it!

[@diwakarkumar3216]

Please keep making videos on all topics

[@netsums]

I will try my best!

[@normannueno2872]

Awesome!!!

[@netsums]

Thank you, I'm glad you liked the video. 😊

[@blackknight985]

Excellent video! just a quick question, how did you get rid of the warning message about API Key after committing the changes?

[@netsums]

Can you post here the warning message you're getting?

[@RishiRap]

You configured a security policy with zone "lab2" for both src and dst close to 9.50 timeline. Isn't Intra-zone policy is default and allows "all"? Please clarify. Thanks.

[@netsums]

You're 100% correct, this rule wouldn't be necessary with standard default rules. But I personally am not a big fan of intra-zone allow as default, so I have in my lab an override with a deny for my intra-zone default rule. So I had to add this rule. But nice caught! :-)

[@fisa6835]

Hallo, I'd like to ask, can I use this way to allow users that already join domain (AD users) to bypass captive portal and non ad users has to go to captive portal?

[@juliaperez9958]

Thank you, this is very helpful. With this setup, user mapping is working, but server monitoring under User-Identification-user mapping isn't. Do you have any suggestions to get server monitoring to work

[@netsums]

Thank you for the comment. You don't need to configure anything in the server monitoring if you have a windows based User-ID agent. If you are trying to configure the PAN-OS User-ID agent, I would suggest you to think about the windows based agent, in my experience it's a lot less problematic to setup.

[@juliaperez9958]

@@netsums Thank you very much for the advice. I will give that a try.

[@brianleb]

How would I setup multiple firewalls to use the CA generated on one firewall?

[@brianleb]

Answer is to export the CA cert from the originating firewall and then import it on each additional PA and setup the in a Cert Profile and attach that to the UserID Connection Security

[@ADempsey]

If we use a public cert from globalsign will it be generated on the UserID server or from the Palo?

[@netsums]

You need to install the certificate on the User-ID server.

[@潘群崴]

Sorry to bother you, but I have a question. I have completed the User ID Agent configuration, and I can see the user information under MONITOR > User ID. However, only the user information is currently displayed. How can I configure it to display the group information as well?

[@netsums]

Hi. You probably need gouo mapping. Take a look at this video, there is a session there that I show how it can be configured: kzbin.info/www/bejne/hoapYpt3e5tjd7ssi=sKaytILFlLi2klYD Let me know later if the video could help you solve the problem. :-)

[@Domesteron1998]

Idk what is wrong, for me not working redestribute status is "No"..

[@netsums]

Sorry for the late reply. Hard to say, many reasons: - Port 5007 not being allowed - Certificate not bein able to validate (does it work without certificate validation?). Use Packet Capture to debug it - Pre-shared Key not matching... What error messages are you receiving?

[@KyleLilleyBPS]

@@netsums **excellent** video, worked perfectly. only extra thing related to this fellas question is we needed to add a windows firewall rule to allow the 5007 traffic before it would allow the communication

[@netsums]

Thank you for the reply!